5.3med
CVE-2019-10184
Undertow Missing Authorization when requesting a protected directory without trailing slash
Also known as GHSA-w69w-jvc7-wjgv
Published 7 y ago · modified 4 mo ago · JSON
CVSS
5.3
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
3.5%
percentile 89%
Public exploits
0
none known
Summary
undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api.
Exploit prediction (EPSS)
3.48% probability of exploitation in the next 30 days, higher than 89% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
| GitHub | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | io.undertow:undertow-servlet | <2.0.23 | 2.0.23 |
Affected products
- undertow-io undertow
Classification
- Weakness
- CWE-862 Missing Authorization
References
- access.redhat.com /errata/RHSA-2019:2937 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:2935 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:2936 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:2938 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:2998 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:3044 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:3045 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:3050 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2019:3046 · vendor-advisory, x_refsource_REDHAT, x_transferred
- access.redhat.com /errata/RHSA-2020:0727 · vendor-advisory, x_refsource_REDHAT, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10184 · x_refsource_CONFIRM, x_transferred
- github.com /undertow-io/undertow/pull/794 · x_refsource_CONFIRM, x_transferred
- security.netapp.com /advisory/ntap-20220210-0016/ · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2019-10184 · advisory
- github.com /undertow-io/undertow/commit/5fa7ac68c0e4251c93056d9982db5e794e04ebfa · web
- issues.redhat.com /browse/UNDERTOW-1578 · web
- security.netapp.com /advisory/ntap-20220210-0016 · web
Sources
- CVE List: CVE-2019-10184
- GitHub Advisory: GHSA-w69w-jvc7-wjgv
- NVD: CVE-2019-10184
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.